PT-2015-6115 · Linux+5 · Linux-Pam+5

Sebastien Macke · Publicado 2015-07-05 · Atualizado 2024-06-15 · CVE-2015-3238

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Linux-PAM versions prior to 1.2.1

Description The issue allows local users to enumerate usernames or cause a denial of service via a large password when the unix run helper binary function in the pam unix module is unable to directly access passwords.

Recommendations For versions prior to 1.2.1, update to version 1.2.1 or later to resolve the issue.

Exploit

Correção

DoS

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2016-1613

CESA-2015_1640

CVE-2015-3238

ELSA-2015-1640

MGASA-2015-0266

OPENSUSE-SU-2024:10405-1

RHSA-2015:1640

RHSA-2015_1640

SUSE-SU-2016:1645-1

SUSE-SU-2017:1398-1

SUSE-SU-2017:2699-1

SUSE-SU-2017:2700-1

SUSE-SU-2017_1398-1

USN-2935-1

USN-2935-2

Produtos afetados

Alt Linux

Centos

Linux-Pam

Red Hat

Suse

Ubuntu

Referências · 71

• 🔥 https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-011/?fid=6551 · Exploit
• 🔥 https://trustwave.com/Resources/SpiderLabs-Blog/Username-Enumeration-against-OpenSSH-SELinux-with-CVE-2015-3238 · Exploit
• https://errata.altlinux.org/ALT-PU-2016-1613 · Aviso do Fabricante
• https://lists.fedoraproject.org/pipermail/package-announce/2015-June/161249.html · Aviso do Fabricante
• https://lists.centos.org/pipermail/centos-announce/2015-August/083502.html · Nota
• https://lists.centos.org/pipermail/centos-announce/2015-August/033378.html · Nota
• https://security.gentoo.org/glsa/201605-05 · Aviso do Fabricante
• https://redhat.com/archives/pam-list/2015-June/msg00001.html · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2017-May/002919.html · Nota
• https://suse.com/security/cve/CVE-2010-3853 · Nota
• http://openwall.com/lists/oss-security/2015/06/25/13 · Nota
• http://ubuntu.com/usn/USN-2935-1 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/161249.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-7041 · Nota
• https://ubuntu.com/security/CVE-2013-7041 · Aviso do Fabricante